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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Kevin Zilka on 7/23/2008. 

The application has been amended as follows: 



Please replace the claims with the claim listing which begins on the following page. 
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Drawings 

The drawings filed on 2/1/2002 are acceptable subject to correction of the informalities 
indicated below. In order to avoid abandonment of this application, correction is required in 
reply to the Office action. The correction will not be held in abeyance. 

Fig. 8 Step 1 1 1 shows "TCP?" and provides two answers to the question, both answers 
being "No". The answer directed to step 1 13 should read "Yes". 

Reasons for Allowance 

The following is an examiner's statement of reasons for allowance: 
While the prior art teaches monitoring a packet stream in order to detect virus infected 
packets or network attacks, the prior art does not teach doing so passively , as claimed, while also 
spoofing a network protocol packet by sending a legitimate packet to a network domain in place 
of an infected packet , in the particular combination of limitations as claimed. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
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fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 

Oath/Declaration 

This application presents a claim for subject matter not originally claimed or embraced in 
the statement of the invention. In this case, the new subject matter is subject matter of claims 53- 
54, and 57-58. A supplemental oath or declaration is required under 37 CFR 1.67. The new oath 
or declaration must properly identify the application of which it is to form a part, preferably by 
application number and filing date in the body of the oath or declaration. See MPEP §§ 602.01 
and 602.02. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MATTHEW T. HENNING whose telephone number is 
(571)272-3790. The examiner can normally be reached on M-F 8-4. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Matthew T Henning/ 

Patent Examiner, Art Unit 2131 

/Ayaz R. Sheikh/ 

Supervisory Patent Examiner, Art Unit 2131 



